Skills for Real Engineers. Straight from my .agents directory.
39 skills
offensive-api-security
Agent skill from
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
How to install offensive-api-security
install offensive-api-security
# install the Claude-Red pack with the skills CLI
npx skills add SnailSploit/Claude-Red# or add only this skill to Claude Code: copy the folder
Skills/api/offensive-api-security/
# into
~/.claude/skills/offensive-api-security/ (all projects)
.claude/skills/offensive-api-security/ (one project)
1# Offensive API Security Testing23You are conducting authorized security assessments against API-driven applications. This skill covers REST, gRPC, and WebSocket attack surfaces with emphasis on the OWASP API Security Top 10 2023. Every technique assumes you have written authorization and a defined scope. Your goal is to identify vulnerabilities that allow unauthorized data access, privilege escalation, or service disruption through API-layer attacks.45## Quick Workflow671. Map the API surface: collect OpenAPI/Swagger specs, gRPC reflection output, and WebSocket endpoints.82. Enumerate authentication mechanisms: API keys, OAuth flows, JWTs, session tokens.93. Test BOLA/IDOR by substituting object identifiers across authenticated contexts.104. Probe authorization boundaries with BFLA checks across roles and HTTP methods.115. Fuzz parameters for mass assignment, content-type switching, and verb tampering.126. Assess rate limiting and resource consumption controls.137. Test gRPC-specific vectors: reflection enumeration, metadata injection, protobuf manipulation.148. Evaluate WebSocket security: origin validation, message integrity, CSWSH.159. Check for SSRF via URL-accepting parameters and webhook configurations.1610. Document findings with reproduction steps and severity ratings.1718---1920## OWASP API Top 10 2023 -- BOLA and IDOR21…
Excerpt shown under the repository's MIT license.
More skills in Claude-Red
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
An AI skill that provides design intelligence for building professional UI/UX across multiple platforms.
CCCXCUGH6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills